AI agent training for internal auditors in insurance in Italy

Italian insurers' internal auditors need practical AI literacy to test agents working motor claims, bancassurance sales checks and complaint replies. They must read verdicts and approvals in the decision record, test certificate currency and provenance, and rate findings consistently. Their opinion and independence stay intact. IVASS, the Garante, GDPR, DORA and the EU AI Act set the frame.

What does internal audit focus on at an Italian insurer?

Motor third-party liability is the largest line for many Italian non-life insurers, and claims there carry both volume and fraud risk. Auditors test how quickly offers are made against the deadlines set by law, whether damage assessments are consistent, and how suspected fraud is escalated. On the life side, much of the business is sold through bank branches, so auditors test product governance and whether the product suited the customer at the point of sale.

The function reports to the board and works alongside risk management, compliance and the actuarial function under the EU prudential regime for insurers. IVASS inspects, and auditors prepare the evidence. DORA has added ICT resilience and third-party oversight to the plan.

What changes when agents arrive?

Agents arrive first in the processes with the most documents. For each one, audit needs to know the depth the agent holds and what it can and cannot do.

• Motor claims document checks (depth 2). The agent reads the joint accident report, photos, repair estimates and policy data, then drafts a settlement offer that a claims handler approves.
• Fraud indicator screening (depth 1). It flags claims that match known patterns, such as repeated parties or garages, for a specialist to investigate.
• Bancassurance suitability checks (depth 1). It compares the questionnaire with the product sold and flags mismatches.
• Complaint reply drafting (depth 2). It drafts the reply in Italian with references to the policy terms. A complaints officer sends it.

Audit itself can use an agent at depth 1 to test full populations from the append-only record, for example every settlement offer in a quarter, and at depth 2 to draft workpapers.

What must auditors learn, and what stays with them?

Auditors first need the mechanics of verdicts. An action is allowed, held for a named person, refused because it is outside the agent's bounds, or withheld at the platform floor. In motor claims, the most useful audit test is whether held offers were approved by someone whose authority covers the amount, and whether any offer was allowed when the agent's certificate had lapsed. Our guide on how internal auditors review an AI agent's decisions sets out the test design.

Second, consistency between auditors. Two auditors looking at the same agent finding should rate it the same way. Running calibration sessions for internal auditors on anonymised agent findings builds that shared scale before findings reach the audit committee.

Third, hands-on experience. Auditors who have themselves reviewed held decisions understand what good review looks like. Those who take operator-level training can record their practice decisions in a practicum log template for internal auditors, which also becomes evidence of competence.

What stays with the auditor: the scope of the plan, the opinion, the rating of findings and the report to the board. Our piece on whether AI agents will replace internal auditors explains why.

Which Italian rules shape oversight and literacy?

IVASS supervises Italian insurers and expects an effective system of governance with independent internal audit. When agents work inside claims or distribution, they are part of the system IVASS expects the board to oversee, and auditors need the skills to test it. EIOPA works on consistent supervision across the EU, so expectations set elsewhere in the Union tend to reach Italian insurers too.

The EU AI Act applies. Article 4 requires AI literacy among staff who operate AI systems, and Annex III lists risk assessment and pricing for life and health insurance as high-risk. For high-risk uses, Article 26 deployer duties and Article 14 human oversight apply, and Article 12 requires automatic logs. Motor claims handling is not in that list, but its decisions still affect customers and must be explainable.

GDPR governs personal data, with Article 22 limiting solely automated decisions with significant effects and Article 35 requiring impact assessments for high-risk processing. The Garante supervises. DORA applies to insurers and covers ICT risk, incident reporting, testing and third-party risk.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

A 90-day plan for the audit function

Days 1 to 30. All auditors complete basic literacy on governed agents. Audit managers list each agent, its capabilities, certified depth and certificate expiry in the audit universe.

Days 31 to 60. Two auditors take operator-level training and log practice decisions. A pilot audit of motor claims document checks tests settlement offers from the record, approver authority and certificate currency.

Days 61 to 90. Hold the first calibration session on agent findings, agree the rating scale, and draft the standing audit programme for agents, including the DORA third-party angle.

Where the Academy fits

Pryme Intelligence Academy's Operator track includes a two-week practicum of real review decisions signed off by a Pryme assessor, which gives auditors first-hand experience of the control they will test. The track's module tests are set in insurance and the auditor's role. For a whole team, an admin view shows progress, results and certificate expiry dates.